PeopleSoft Enterprise FIN CVE-2026-61070

No special authentication or elevated privileges are required - the CVSS vector (PR:N/AC:L) confirms unauthenticated network exploitation against the default exposed HTTP interface of PeopleSoft Enterprise FIN Common Objects Argentina 9.1. Exploitation is limited by the following factors: the vulnerability affects only version 9.1 of the Argentina-specific PeopleSoft FIN module, so deployments using other versions or standard (non-Argentina) PeopleSoft FIN are not confirmed affected; the attacker must have network-layer reachability to the PeopleSoft HTTP service; and impact is bounded to partial availability degradation (A:L) with no confidentiality or integrity exposure. No specific feature toggle or non-default configuration is mentioned as a prerequisite in the available data.

Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) scores 5.3 Medium, reflecting easy network exploitation with no authentication barrier but constrained to partial availability impact only. No EPSS data was provided; however, given the product's regional specificity, niche ERP context, and absence of KEV or POC, real-world exploitation probability is assessed as low. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. The primary concern is availability disruption to Cash Management workflows - a meaningful operational risk for financial institutions relying on this component during business-critical periods, but not a data-breach or integrity risk. The mismatch between easy exploitability (AC:L/PR:N) and limited impact (A:L only, no C or I) reduces overall priority compared to higher-impact RCE or data-exposure vulnerabilities at the same CVSS score.

An unauthenticated attacker with HTTP network access to the PeopleSoft Enterprise FIN instance sends crafted requests to the Cash Management component, inducing a partial service disruption. No exploit code has been identified, so exploitation would require independent discovery of the triggering condition. The low attack complexity suggests this could be achieved through targeted fuzzing or manipulation of publicly observable HTTP parameters against the Cash Management endpoint.